Understanding X.509 Certificate Structure
X.509 certificates use ASN.1 DER encoding wrapped in base64 PEM format. The certificate contains a TBSCertificate (To Be Signed) structure holding the subject, issuer, validity period, and public key, followed by the signature algorithm identifier and the digital signature itself. The TBSCertificate fields are arranged in a strict sequence defined by RFC 5280.
Subject and Issuer Fields
The subject identifies the certificate owner using Distinguished Name attributes like Common Name (CN) for the domain, Organization (O) for the company, and Country (C) for jurisdiction. The issuer uses the same format to identify the Certificate Authority that signed the certificate. Extended Validation certificates include additional fields like jurisdiction and business category.
Validity and Expiry Management
Every certificate has a Not Before and Not After timestamp defining its validity window. Certificates typically last one year for public TLS, though internal certificates may have longer lifetimes. Monitoring expiry dates prevents service outages caused by expired certificates. Automated renewal with tools like certbot or ACME clients eliminates manual tracking.
Signature Algorithms and Key Strength
Modern certificates use SHA-256 or stronger hash algorithms with RSA (2048+ bit) or ECDSA (P-256, P-384) keys. SHA-1 signatures are deprecated and rejected by browsers. RSA 4096-bit keys offer higher security at the cost of larger handshake sizes, while ECDSA P-256 provides equivalent security with smaller keys and faster TLS handshakes.
